697 lines
31 KiB
Text
697 lines
31 KiB
Text
# 2026-05-09 08:51:42 by RouterOS 7.21.4
|
|
# software id = HVP9-3G0K
|
|
#
|
|
# model = CCR1009-7G-1C-1S+
|
|
# serial number = 7AF2078E2C9B
|
|
/interface bridge
|
|
add add-dhcp-option82=yes dhcp-snooping=yes disabled=yes igmp-snooping=yes \
|
|
name=culleoka port-cost-mode=short
|
|
add name=culleoka-tower port-cost-mode=short
|
|
add name=mgmt port-cost-mode=short
|
|
add name=public port-cost-mode=short
|
|
/interface ethernet
|
|
set [ find default-name=combo1 ] l2mtu=9000
|
|
set [ find default-name=ether1 ] l2mtu=2024 name=ether1-climax-11ghz \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether2 ] l2mtu=9000 name=ether2-netonix
|
|
set [ find default-name=ether3 ] l2mtu=9000 rx-flow-control=auto \
|
|
tx-flow-control=auto
|
|
set [ find default-name=ether4 ] disabled=yes l2mtu=9000 name=ether4-climax
|
|
set [ find default-name=ether5 ] l2mtu=9000 name=ether5-jeff-tv \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether6 ] advertise="10M-baseT-half,10M-baseT-full,100M\
|
|
-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full" l2mtu=2024 name=\
|
|
ether6-380-11ghz rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether7 ] advertise="10M-baseT-half,10M-baseT-full,100M\
|
|
-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full" l2mtu=9000 name=\
|
|
"ether7-maybe-bad\?" rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=sfp-sfpplus1 ] disabled=yes l2mtu=9000 name=\
|
|
sfp-sfpplus1-10g-switch
|
|
/interface vlan
|
|
add interface=ether2-netonix name=vlan10_ether2 vlan-id=10
|
|
add interface=ether2-netonix name=vlan100_netonix8 vlan-id=100
|
|
add interface=ether2-netonix name=vlan101_netonix9 vlan-id=101
|
|
add interface=ether2-netonix name=vlan102_netonix10 vlan-id=102
|
|
add interface=ether2-netonix name=vlan103_netonix13 vlan-id=103
|
|
add interface=ether2-netonix name=vlan104_netonix14 vlan-id=104
|
|
add interface=ether2-netonix name=vlan_30_clayton vlan-id=30
|
|
/interface lte apn
|
|
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
|
|
/interface wireless security-profiles
|
|
set [ find default=yes ] supplicant-identity=MikroTik
|
|
/ip hotspot profile
|
|
add dns-name=culleoka.vntx.net hotspot-address=10.100.111.254 login-by=mac \
|
|
mac-auth-mode=mac-as-username-and-password name=hsprof1
|
|
/ip hotspot
|
|
add addresses-per-mac=unlimited idle-timeout=none interface=ether2-netonix \
|
|
name=hotspot1 profile=hsprof1
|
|
/ip hotspot user profile
|
|
set [ find default=yes ] add-mac-cookie=no on-logout=" /ip hotspot host remove\
|
|
\_[find where address=\94\$address\94 and !authorized and !bypassed]" \
|
|
session-timeout=6h status-autorefresh=6m
|
|
/ip ipsec proposal
|
|
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
|
|
aes-256-cbc,aes-128-cbc pfs-group=modp2048
|
|
/ip pool
|
|
add name=culleoka-cgnat ranges=100.64.25.1-100.64.27.199
|
|
add name=cpe ranges=10.10.96.1-10.10.110.254
|
|
add name=culleoka-tower ranges=10.0.104.1-10.0.104.99
|
|
add name=clayton ranges=100.64.128.1-100.64.130.254
|
|
add name=culleoka-cgnat-new ranges=100.64.96.1-100.64.111.253
|
|
/ip dhcp-server
|
|
add address-pool=cpe interface=mgmt lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=cpe use-radius=accounting
|
|
add address-pool=culleoka-tower interface=culleoka-tower lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success 0\
|
|
\n\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=po\
|
|
st \\\
|
|
\n http-data=\"{\\\"bound\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\
|
|
\"\$leaseActMAC\\\",\\\"ip\\\":\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$l\
|
|
easeServerName\\\",\\\"remoteId\\\":\\\"\\\"}\"\
|
|
\n :set success 1;\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send unassignment to gaiia on attempt \
|
|
\$attempts/\$max for \$leaseBound / \$leaseActMAC / \$leaseActIP / \$remot\
|
|
eID\";\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n\
|
|
\n } else {\
|
|
\n\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=po\
|
|
st \\\
|
|
\n http-data=\"{\\\"bound\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\
|
|
\"\$leaseActMAC\\\",\\\"ip\\\":\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$l\
|
|
easeServerName\\\",\\\"remoteId\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success 1;\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia on attempt \$\
|
|
attempts/\$max for \$leaseBound / \$leaseActMAC / \$leaseActIP / \$remoteI\
|
|
D\";\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success) do {\
|
|
\n :log info \"DHCP lease message successfully sent \$leaseActMAC / \$l\
|
|
easeActIP to gaiia\";\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n\
|
|
\n} while (\$attempts < \$max)\
|
|
\n\
|
|
\n}\
|
|
\n" lease-time=1h name=culleoka-tower
|
|
add address-pool=clayton disabled=yes interface=vlan_30_clayton lease-time=\
|
|
10m name=clayton
|
|
/ip smb users
|
|
set [ find default=yes ] disabled=yes
|
|
/ipv6 pool
|
|
add name=climax-v6 prefix=2606:1c80:1:4000::/52 prefix-length=64
|
|
/ppp profile
|
|
add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \
|
|
local-address=100.64.27.253 name=pppoe on-down="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
|
|
\_for \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
|
|
n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (AWS API)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
|
|
r \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
|
|
\_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" on-up="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 5\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
|
|
or \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
|
|
attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
|
|
\$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
|
|
empt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" only-one=no remote-address=culleoka-cgnat use-compression=no \
|
|
use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
|
|
/queue simple
|
|
add burst-limit=1/1 burst-threshold=1/1 burst-time=1s/1s limit-at=1/1 \
|
|
max-limit=1/1 name=Inactive packet-marks=Inactive priority=2/2 target=""
|
|
/queue type
|
|
add kind=fq-codel name=fq-codel
|
|
/queue interface
|
|
set combo1 queue=fq-codel
|
|
set ether1-climax-11ghz queue=fq-codel
|
|
set ether2-netonix queue=fq-codel
|
|
set ether3 queue=fq-codel
|
|
set ether4-climax queue=fq-codel
|
|
set ether5-jeff-tv queue=fq-codel
|
|
set ether6-380-11ghz queue=fq-codel
|
|
set "ether7-maybe-bad\?" queue=fq-codel
|
|
set sfp-sfpplus1-10g-switch queue=fq-codel
|
|
/routing bgp instance
|
|
add as=393837 name=bgp-instance-1 router-id=10.254.254.104
|
|
/routing bgp template
|
|
set default as=393837 disabled=yes output.network=bgp-networks .redistribute=\
|
|
connected
|
|
/routing id
|
|
add disabled=no id=10.254.254.104 name=id-1 select-dynamic-id=""
|
|
/routing ospf instance
|
|
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
|
ospf-out redistribute=connected router-id=id-1
|
|
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
|
ospf-out redistribute=connected router-id=id-1 version=3
|
|
/routing ospf area
|
|
add disabled=no instance=default-v2 name=backbone-v2
|
|
add disabled=no instance=default-v3 name=backbone-v3
|
|
/snmp community
|
|
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
|
kdyyJrT0Mm
|
|
/system logging action
|
|
add name=Syslog remote=204.110.191.234 remote-log-format=syslog src-address=\
|
|
10.254.254.104 target=remote
|
|
add name=logs remote=204.110.191.229 src-address=10.254.254.104 target=remote
|
|
/interface bridge port
|
|
add bridge=culleoka hw=no ingress-filtering=no interface=ether2-netonix \
|
|
internal-path-cost=10 path-cost=10
|
|
add bridge=culleoka disabled=yes ingress-filtering=no interface=\
|
|
sfp-sfpplus1-10g-switch internal-path-cost=10 path-cost=10
|
|
add bridge=culleoka disabled=yes ingress-filtering=no interface=*10 \
|
|
internal-path-cost=10 path-cost=10
|
|
add bridge=mgmt ingress-filtering=no interface=vlan10_ether2 \
|
|
internal-path-cost=10 path-cost=10
|
|
/ip firewall connection tracking
|
|
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
|
tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
|
|
tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
|
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
|
/ip settings
|
|
set tcp-syncookies=yes
|
|
/interface pppoe-server server
|
|
add accept-empty-service=no authentication=chap,mschap2 default-profile=pppoe \
|
|
disabled=no interface=ether2-netonix max-mtu=1492 service-name=culleoka
|
|
add default-profile=pppoe disabled=no interface=vlan_30_clayton max-mtu=1492 \
|
|
one-session-per-host=yes service-name=clayton
|
|
add default-profile=pppoe disabled=no interface=ether5-jeff-tv max-mtu=1492 \
|
|
one-session-per-host=yes service-name=jeff-tv
|
|
add default-profile=pppoe disabled=no interface=vlan100_netonix8 max-mtu=1492 \
|
|
one-session-per-host=yes service-name=service1
|
|
add default-profile=pppoe disabled=no interface=vlan101_netonix9 max-mtu=1492 \
|
|
one-session-per-host=yes service-name=service2
|
|
add default-profile=pppoe disabled=no interface=vlan102_netonix10 max-mtu=\
|
|
1492 one-session-per-host=yes service-name=service3
|
|
add default-profile=pppoe disabled=no interface=vlan103_netonix13 max-mtu=\
|
|
1492 one-session-per-host=yes service-name=service4
|
|
add default-profile=pppoe disabled=no interface=vlan104_netonix14 max-mtu=\
|
|
1492 one-session-per-host=yes service-name=service5
|
|
/interface sstp-server server
|
|
set certificate=vntx.net.pem_0
|
|
/ip address
|
|
add address=10.254.254.104 interface=lo network=10.254.254.104
|
|
add address=100.64.27.254/22 interface=ether2-netonix network=100.64.24.0
|
|
add address=204.110.188.158/27 interface=public network=204.110.188.128
|
|
add address=10.0.104.254/24 interface=culleoka-tower network=10.0.104.0
|
|
add address=10.10.111.254/20 interface=vlan10_ether2 network=10.10.96.0
|
|
add address=10.250.1.9/29 interface=ether1-climax-11ghz network=10.250.1.8
|
|
add address=10.250.1.49/29 interface=ether6-380-11ghz network=10.250.1.48
|
|
add address=100.64.111.254/20 comment="cgnat /20 (renumber)" interface=\
|
|
ether2-netonix network=100.64.96.0
|
|
/ip dhcp-server
|
|
add add-arp=yes address-pool=culleoka-cgnat dhcp-option-set=vntx interface=\
|
|
ether2-netonix lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=culleoka use-radius=accounting
|
|
/ip dhcp-server alert
|
|
add disabled=no interface=culleoka on-alert=rogue-dhcp valid-server=\
|
|
64:D1:54:D3:E1:50
|
|
/ip dhcp-server lease
|
|
add address=10.10.111.14 mac-address=44:D9:E7:A8:58:C9
|
|
add address=10.10.111.50 mac-address=DC:9F:DB:6F:A6:24
|
|
add address=10.10.111.30 mac-address=00:04:56:D7:AD:09
|
|
add address=10.10.111.31 mac-address=00:04:56:D7:A9:55
|
|
add address=10.10.111.32 mac-address=00:04:56:D7:A9:85
|
|
add address=10.10.111.1 mac-address=78:45:58:A0:03:F3
|
|
add address=10.10.111.2 mac-address=78:45:58:A0:03:FC
|
|
add address=10.10.111.33 mac-address=58:C1:7A:73:BF:9E
|
|
add address=10.10.111.12 mac-address=78:45:58:A2:A9:0A
|
|
add address=10.10.111.34 mac-address=58:C1:7A:71:C5:25
|
|
add address=10.10.111.11 mac-address=78:45:58:A2:EC:F9
|
|
add address=10.10.111.61 mac-address=78:8A:20:EC:76:DC
|
|
add address=10.10.111.60 mac-address=44:D9:E7:5A:A8:0E
|
|
/ip dhcp-server network
|
|
add address=10.0.104.0/24 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=10.0.104.254 ntp-server=204.110.191.19
|
|
add address=10.10.96.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=10.10.111.254 ntp-server=204.110.191.19
|
|
add address=100.64.24.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=100.64.27.254 ntp-server=204.110.191.19
|
|
add address=100.64.96.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=100.64.111.254 ntp-server=204.110.191.19
|
|
add address=204.110.188.128/27 dns-server=204.110.191.240,204.110.191.20 \
|
|
domain=vntx.net gateway=204.110.188.158 ntp-server=204.110.191.19
|
|
/ip dhcp-server option sets
|
|
add name=vntx options=*1
|
|
/ip dns
|
|
set servers=9.9.9.9,1.1.1.1
|
|
/ip firewall address-list
|
|
add address=10.254.254.104 disabled=yes list=bgp-networks
|
|
add address=10.10.96.0/20 disabled=yes list=bgp-networks
|
|
add address=100.64.24.0/22 disabled=yes list=bgp-networks
|
|
add address=204.110.188.128/27 disabled=yes list=bgp-networks
|
|
/ip firewall filter
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether6-380-11ghz
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether6-380-11ghz
|
|
add action=fasttrack-connection chain=forward comment=\
|
|
"fasttrack established/related" connection-state=established,related
|
|
add action=accept chain=forward comment="accept established/related" \
|
|
connection-state=established,related
|
|
/ip hotspot ip-binding
|
|
add address=100.64.27.97 type=bypassed
|
|
add address=100.64.25.4 type=bypassed
|
|
add address=100.64.26.42 type=bypassed
|
|
add mac-address=E4:C3:2A:A1:11:50 type=blocked
|
|
add address=1.1.1.1 type=bypassed
|
|
add address=10.100.111.0/24 type=bypassed
|
|
add address=100.64.27.252 type=bypassed
|
|
add address=10.10.0.0/16 type=bypassed
|
|
add address=100.64.27.240 mac-address=F0:9F:C2:0D:56:F3 server=hotspot1 \
|
|
to-address=100.64.27.240 type=bypassed
|
|
add address=100.64.27.166 mac-address=24:A4:3C:32:18:D0 server=hotspot1 \
|
|
to-address=100.64.27.166 type=bypassed
|
|
add address=100.64.27.248/29 type=bypassed
|
|
add address=100.64.27.253 type=bypassed
|
|
add address=100.64.27.250 type=bypassed
|
|
add address=100.64.24.0/22
|
|
add address=204.110.188.128/27
|
|
add address=0.0.0.0/0 type=blocked
|
|
/ip hotspot walled-garden
|
|
add comment="place hotspot rules here" disabled=yes
|
|
/ip ipsec profile
|
|
set [ find default=yes ] dh-group=modp2048 enc-algorithm=aes-256,aes-128 \
|
|
hash-algorithm=sha256
|
|
/ip proxy
|
|
set cache-path=web-proxy1 port=23435
|
|
/ip proxy access
|
|
add src-address=10.0.0.0/8
|
|
add src-address=204.110.188.0/22
|
|
add src-address=100.64.0.0/10
|
|
add action=deny
|
|
/ip route
|
|
add disabled=no dst-address=0.0.0.0/0 gateway=10.250.1.54
|
|
/ip service
|
|
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes port=81
|
|
set www-ssl address=204.110.188.0/22,10.0.0.0/8 certificate=vntx.net.pem_0
|
|
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
|
|
set winbox address=204.110.188.0/22,10.0.0.0/8
|
|
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|
set api-ssl certificate=vntx.net.pem_0
|
|
/ip ssh
|
|
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
|
/ip traffic-flow
|
|
set cache-entries=256k enabled=yes
|
|
/ipv6 address
|
|
add address=2606:1c80::4/128 advertise=no interface=*D
|
|
add address=2606:1c80:1:4000::/52 advertise=no interface=culleoka
|
|
add address=2606:1c80:0:10::2 interface=ether1-climax-11ghz
|
|
/ipv6 dhcp-server
|
|
add interface=culleoka name=server1 prefix-pool=climax-v6
|
|
/mpls interface
|
|
add interface=ether6-380-11ghz mpls-mtu=1508
|
|
/mpls ldp
|
|
add disabled=no lsr-id=10.254.254.104 transport-addresses=10.254.254.104 vrf=\
|
|
main
|
|
/mpls ldp interface
|
|
add interface=ether6-380-11ghz
|
|
/ppp aaa
|
|
set interim-update=1h use-radius=yes
|
|
/radius
|
|
add address=204.110.191.248 require-message-auth=no service=ppp,hotspot,dhcp \
|
|
src-address=204.110.188.158 timeout=2s
|
|
add address=204.110.191.2 require-message-auth=no service=ppp,hotspot,dhcp \
|
|
src-address=204.110.188.158 timeout=2s
|
|
add accounting-backup=yes address=45.76.56.5 disabled=yes \
|
|
require-message-auth=no service=ppp,hotspot,dhcp src-address=\
|
|
204.110.188.158 timeout=2s
|
|
/routing bfd configuration
|
|
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
|
/routing bgp connection
|
|
add afi=ip,ipv6 cisco-vpls-nlri-len-fmt=auto-bits connect=yes instance=\
|
|
bgp-instance-1 listen=yes local.role=ibgp name=culleoka_climax \
|
|
nexthop-choice=force-self remote.address=10.250.1.14 .as=393837 .port=179 \
|
|
templates=default
|
|
/routing filter rule
|
|
add chain=ospf-in disabled=no rule="accept;"
|
|
add chain=ospf-out disabled=no rule="accept;"
|
|
/routing ospf interface-template
|
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=20 disabled=no interfaces=\
|
|
ether1-climax-11ghz priority=1 type=ptp use-bfd=yes
|
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|
ether6-380-11ghz priority=1 type=ptp use-bfd=yes
|
|
add area=backbone-v3 cost=10 disabled=no passive priority=1 use-bfd=no
|
|
add area=backbone-v2 disabled=no passive
|
|
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
|
|
ether1-climax-11ghz type=ptp
|
|
add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\
|
|
ether6-380-11ghz type=ptp
|
|
/routing ospf static-neighbor
|
|
add address=10.250.1.14%ether1-climax-11ghz area=backbone-v2 comment=climax \
|
|
disabled=no poll-interval=10s
|
|
add address=10.250.1.54%ether6-380-11ghz area=backbone-v2 comment=380 \
|
|
disabled=no poll-interval=10s
|
|
/snmp
|
|
set contact=graham@vntx.net enabled=yes location="33.113681, -96.487876"
|
|
/system clock
|
|
set time-zone-name=America/Chicago
|
|
/system identity
|
|
set name=Culleoka
|
|
/system logging
|
|
add action=logs topics=info
|
|
add action=logs disabled=yes topics=dhcp
|
|
add disabled=yes topics=dhcp
|
|
/system note
|
|
set note="__ __\
|
|
\n\\ \\ / /__ _ __ ___ _ __ __ _\
|
|
\n \\ \\ / / _ \\ '__/ _ \\| '_ \\ / _` |\
|
|
\n \\ V / __/ | | (_) | | | | (_| |\
|
|
\n \\_/ \\___|_| \\___/|_| |_|\\__,_|\
|
|
\n _ _ _ _\
|
|
\n| \\ | | ___| |___ _____ _ __| | _____\
|
|
\n| \\| |/ _ \\ __\\ \\ /\\ / / _ \\| '__| |/ / __|\
|
|
\n| |\\ | __/ |_ \\ V V / (_) | | | <\\__ \\\
|
|
\n|_| \\_|\\___|\\__| \\_/\\_/ \\___/|_| |_|\\_\\___/\
|
|
\n\
|
|
\n###############################################################\
|
|
\n# Welcome to Verona Networks #\
|
|
\n# All connections are monitored and recorded #\
|
|
\n# Disconnect IMMEDIATELY if you are not an authorized user! #\
|
|
\n###############################################################\
|
|
\n\
|
|
\n" show-at-login=no
|
|
/system ntp client
|
|
set enabled=yes
|
|
/system ntp client servers
|
|
add address=ntp.vntx.net
|
|
add address=0.us.pool.ntp.org
|
|
/system package update
|
|
set channel=long-term
|
|
/system routerboard settings
|
|
# Firmware upgraded successfully, please reboot for changes to take effect!
|
|
set auto-upgrade=yes
|
|
/system scheduler
|
|
add interval=5m name=remove_hotspot on-event=\
|
|
"/ip hotspot host remove [/ip hotspot host find where !authorized]" \
|
|
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
|
|
start-time=startup
|
|
add name=reboot on-event="/system reboot" policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
|
|
2025-01-21 start-time=03:20:00
|
|
/system script
|
|
add dont-require-permissions=no name=rogue-dhcp owner=admin policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
|
|
":log warning message=\"Rogue DHCP server detected!\""
|
|
/tool bandwidth-server
|
|
set enabled=no
|